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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 1 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )^ Responsive to communication(s) filed on 04 March 2003 . 
2a)D This action is FINAL. 2b)^ This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) ^3 Claim(s) 1-39 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) D Claim(s) is/are rejected. 

7) D Claim(s) is/are objected to. 

8) Kl Claim(s) 1-39 are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)Q The drawing(s) filed on is/are: a)Q accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1 .121 (d). 
11 )D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

Election/Restrictions 

1- Restriction to one of the following inventions is required 
under 35 U.S.C. 121: 

I. Claims 1-15, drawn to a method of detecting states to 
detect unauthorized behavior or software, classified 
in class 713, subclass 188. 

II. Claims 16-17 and 21, drawn to a method of 
electronically mapping a hard drive, classified in 
class 707, subclass 204. 

III. Claim 18, drawn to monitoring messages between the 
operating system and an application, classified in 
class 719, subclass 329. 

IV. Claim 19, drawn to backing up computer registry 
information, classified in class 711, subclass 162. 

V. Claims 20 and 22, drawn to comparing activity states 
between current and stored states to determine 
differences, classified in class 714, subclass 49. 

VI. Claims 23 and 25, drawn to comparing messages to 
detect unauthorized activity, classified in class 714, 
subclass 723. 
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VII. Claim 24, drawn to detecting unauthorized activity and 
sending the report to a second computer, classified in 
class 709, subclass 224. 

VIII. Claims 26-39, drawn to detecting states that are 
active to determine modification, classified in class 
714, subclass 21. 

The inventions are distinct, each from the other because of the 
following reasons: 

2. Inventions I and II are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention I has 
separate utility such as detecting unauthorized use without 
mapping of the hard drive as done in invention II. See MPEP § 
806.05 (d) . 

3. Inventions I and III are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention I has 
separate utility such as detecting unauthorized use without 
monitoring operating system message as done in invention III. 
See MPEP § 806. 05 (d) . 
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4 . Inventions I and IV are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention I has 
separate utility such as detecting unauthorized use without 
backing up the registry as done in invention IV. See MPEP § 
806.05 (d) . 

5. Inventions I and V are related as subcombinations disclosed 
as usable together in a 9 single combination. The subcombinations 
are distinct from each other if they are shown to be separately 
usable. In the instant case, invention I has separate utility 
such as detecting unauthorized use without comparing current 
states to stored states as in invention V. See MPEP § 
806.05(d) . 

6. Inventions I and VI are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention I has 
separate utility such as detecting unauthorized use without 
comparing messages as in invention VI. See MPEP § 806.05(d). 

7. Inventions I and VII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
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to be separately usable. In the instant case, invention I has 
separate utility such as detecting unauthorized use without 
sending a report to another computer as done in invention VII. 
See MPEP § 806.05(d) . 

8. Inventions I and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention I has 
separate utility such as detecting unauthorized use without 
determining modification as done in invention VIII. See MPEP § 
806.05 (d) . 

9. Inventions II and III are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention II has 
separate utility such as mapping a hard drive without monitoring 
messages as in invention III. See MPEP § 806.05(d). 

10. Inventions II and IV are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention II has 
separate utility such as mapping a hard drive without backing up 
the computer registry. See MPEP § 806.05(d). 
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11. Inventions II and V are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention II has 
separate utility such as mapping a hard drive without comparing 
activity states as in invention V. See MPEP § 806.05(d). 

12. Inventions II and VI are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention II has 
separate utility such as mapping a hard drive without comparing 
messages as in invention VI. See MPEP § 806.05(d). 

13. Inventions II and VII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention II has 
separate utility such as mapping a hard drive without sending a 
report to a second computer as in invention VII. See MPEP § 
806.05(d) . 

14. Inventions II and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention II has 
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separate utility such as mapping a hard drive without detecting 
states to determine modification as in invention VIII. See MPEP 
§ 806.05(d) . 

15. Inventions III and IV are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention III has 
separate utility such as monitoring messages between the 
operating system and an application without backing up the 
computer registry as in invention IV. See MPEP § 806.05(d). 

16. Inventions III and V are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention III has 
separate utility such as monitoring messages between the 
operating system and an application without comparing activity 
states as in invention V. See MPEP § 806.05(d). 

17. Inventions III and VI are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention III has 
separate utility such as monitoring messages between the 
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operating system and an application without comparing messages 
as in invention VI. See MPEP § 806.05(d). 

18. Inventions III and VII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention III has 
separate utility such as monitoring messages between the 
operating system and an application without sending a report to 
a second computer as in invention VII. See MPEP § 806.05(d). 

19. Inventions III and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention III has 
separate utility such as monitoring messages between the 
operating system and an application without detection states as 
in invention VIII. See MPEP § 806.05(d). 

20. Inventions IV and V are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention IV has 
separate utility such as backing up computer registry 
information without comparing activity states as in invention V. 
See MPEP § 806. 05 (d) . 
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21. Inventions IV and VI are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention IV has 
separate utility such as backing up computer registry 
information without comparing messages as in invention VI. See 
MPEP § 806.05 (d) . 

22. Inventions IV and VII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention IV has 
separate utility such as backing up computer registry 
information without sending a report to a second computer as in 
invention VII. See MPEP § 806.05(d). 

23. Inventions IV and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention IV has 
separate utility such as backing up computer registry 
information without detection states as in invention VIII. See 
MPEP § 806. 05 (d) . 

24. Inventions V and VI are related as subcombinations 
disclosed as usable together in a single combination. The 
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subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention V has 
separate utility such as comparing activity states between 
current and stored states to determine differences without 
comparing messages as in invention. VI . See MPEP § 806.05(d). 

25. Inventions V and VII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention V has 
separate utility such as comparing activity states between 
current and stored states to determine differences without 
sending a report to a second computer as in invention VII. See 
MPEP § 806.05 (d) . 

26. Inventions V and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention V has 
separate utility such as comparing activity states between 
current and stored states to determine differences without 
detecting states that are active as in invention VIII. See MPEP 
§ 806.05 (d) . 

27. Inventions VI and VII are related as subcombinations 
disclosed as usable together in a single combination. The 
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subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention VI has 
separate utility such as comparing messages to detect 
unauthorized activity without sending a report to a second 
computer as in invention VII. See MPEP § 806.05(d). 

28. Inventions VI and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention VI has 
separate utility such as comparing messages to detect 
unauthorized activity without detection states that are active 
as in invention VIII. See MPEP § 806.05(d). 

29. Inventions VII and VIII are related as subcombinations 
disclosed as usable together in a single combination. The 
subcombinations are distinct from each other if they are shown 
to be separately usable. In the instant case, invention VII has 
separate utility such as sending a report of unauthorized 
activity to a second computer without detecting states that are 
active as in invention VIII. See MPEP § 806.05(d). 

30. Because these inventions are distinct for the reasons given 
above and have acquired a separate status in the art as shown by 
their different classification, restriction for examination 
purposes as indicated is proper. 
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Conclusion 

31. A shortened statutory period for response to this action is 
set to expire one month (not less than 30 days) from the mail 
date of this letter. Failure to respond within the period for 
response will result in ABANDONMENT of the application (see 35 
U.S.C. 133, M.P.E.P. 710.02, 710.02(b)). 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Michael 
Pyzocha whose telephone number is (571) 272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 

If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Andrew Caldwell can be 
reached on (571) 272-3868. The fax phone number for the 
organization where this application or proceeding is assigned is 
703-872-9306. 
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Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 
(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . 



MJP 




